Vulnerabilities exist in Apple macOS and Samba systems, developed by Apple and Samba.

Apple has identified several vulnerabilities in macOS specifically related to Golden Gate 27, Sequoia 15.8, and Tahoe 26.7. These vulnerabilities include heap-based buffer overflows, use-after-free errors, integer overflows, null pointer dereferences, improper access control, privilege escalation...

Vulnerabilities found in Apple iOS and iPadOS

Apple has identified several vulnerabilities in iOS and iPadOS. These vulnerabilities involve various security issues, such as authentication failures, out-of-bounds write and read errors, use-after-free situations, buffer overflows, race conditions, permission and authorization problems, memory...

WordPress Ad Inserter plugin <= 2.8.16 - Missing Authorization to Unauthenticated Header/Footer Code Disclosure via 'ai-debug-code' Parameter vulnerability

Missing Authorization to Unauthenticated Header/Footer Code Disclosure via 'ai-debug-code' Parameter vulnerability discovered by Evan - Independent Security Researcher in WordPress Plugin Ad Inserter versions = 2.8.16...

UniBLEed

UniBLEed Unitree G1 RCE PoC & Scripts CVE-2026-76639 / CVE-2026-76640 technical details at boschko.ca/g1-ble-rce/ Use this repository only with robots, accounts, and networks you are authorized to test. The active chains can change the robot's WiFi configuration, stop or restart services, crash...

ghostlock-k419-adapter

GhostLock — OnePlus 잠금 부트로더 탈옥 잠금 부트로더가 적용된 OnePlus/OPPO/realme 기기를 위한 커널 익스플로잇입니다. 부트로더를 잠금 해제하거나 부트 이미지를 수정하지 않고도 루트 권한 획득 및 KernelSU 설치를 달성합니다. 다중 기기 오프셋 테이블을 통한 커널 버전 런타임 자동 감지 기능을 제공합니다. 취약점 CVE-2026-43499 — Futex PI 우선순위 상속 Use-After-Free Linux 커널 2.6.39 7.1에 영향을 미칩니다. 메인라인 7.1커밋...

Security Bulletin: Multiple Vulnerabilities in IBM watsonx Code Assistant On Prem

Summary Multiple vulnerabilities were addressed in IBM watsonx Code Assistant On Prem V5.3.1 Patch 12 Vulnerability Details CVEID:CVE-2026-12143 DESCRIPTION: form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the field argument to FormDataappend a...

CVE-2026-8069

Acer 네임드 파이프에서 NT AUTHORITY\SYSTEM으로: CVE-2026-8069 Acer NitroSense 및 PredatorSense 3.x는 PSSvc라는 Windows 서비스를 설치했으며, 이 서비스는 로컬 사용자에게 사용자 지정 네임드 파이프 프로토콜을 노출했습니다. 하나의 프로토콜 명령은 호출자가 제어하는 실행 파일 경로를 수락하고, winlogon.exe의 토큰을 복제한 다음 해당 실행 파일을 NT AUTHORITY\SYSTEM으로 시작했습니다. 취약한 서비스의 경로 제한은 부분 문자열substring...

CVE-2026-72744-poc

CVE-2026-72744: Nuxt Chrome DevTools 엔드포인트 정보 노출 PoC English version 개요 이 리포지토리는 Nuxt 개발 서버의 Chrome DevTools workspace 엔드포인트에 존재하는 정보 노출 취약점 CVE-2026-72744 의 Proof of Concept PoC입니다. 취약한 개발 서버는 연결 원본이 로컬인지 여부를 TCP peer address가 아닌, 공격자가 지정할 수 있는 Host 등의 HTTP 헤더로 판단합니다. 개발 서버가 0.0.0.0에 바인딩된 경우, LA...

BambooToken Malware Uses MQTT to Control Windows and Linux Systems

Cybersecurity researchers have disclosed details of a multi-platform campaign that uses the Message Queueing Telemetry Transport MQTT protocol as a communication channel to control Windows and Linux systems. The emerging malware family, codenamed BambooToken , is assessed to be active since at...

EUVD-2026-78667

Bucket Squatting in Google Cloud Gemini Enterprise Agent Platform SDK for Python versions prior to 1.166.1 allows an attacker to achieve Remote Code Execution RCE and tenant-project token theft...

CVE-2026-19407

CVE-2026-19407 affects the Google Cloud Gemini Enterprise Agent Platform SDK for Python in versions prior to 1.166.1 . The vulnerability is a GCS Bucket Squatting flaw that allows an attacker to achieve Remote Code Execution (RCE) and tenant-project token theft without requiring prior privileges ...

CVE-2026-19407 GCS Bucket Squatting leading to RCE in Gemini Enterprise Agent Platform Python SDK

Bucket Squatting in Google Cloud Gemini Enterprise Agent Platform SDK for Python versions prior to 1.166.1 allows an attacker to achieve Remote Code Execution RCE and tenant-project token theft...

USN-8767-1: Snapcast vulnerability

It was discovered that Snapcast incorrectly handled crafted JSON-RPC requests. A remote attacker could possibly use this issue to execute arbitrary code or obtain sensitive information...

USN-8767-1 snapcast vulnerability

It was discovered that Snapcast incorrectly handled crafted JSON-RPC requests. A remote attacker could possibly use this issue to execute arbitrary code or obtain sensitive information...

Security Bulletin: IBM Guardium Data Security Center is affected by multiple vulnerabilities

Summary IBM Guardium Data Security Center has addressed these vulnerabilties with an update. Vulnerability Details CVEID:CVE-2026-54515 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5,...

CVE-2026-91988 atomic-agents-stack before 1.1.0 Remote Code Execution via HTTP MCP

atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP server-registry backend factory, allowing network man-in-the-middle attackers to rewrite catalog responses. Attackers can inject arbitrary command and argument values that are spawned as local subprocesses by...

CVE-2026-91988

atomic-agents-stack before 1.1.0 is vulnerable to remote code execution via its HTTP MCP server-registry backend (mcp_registry/http.py, function make_http_mcp_server_registry_backend_from_url). The factory accepts both http and https schemes; over cleartext http://, a network man-in-the-middle ca...

CVE-2026-91988 atomic-agents-stack before 1.1.0 Remote Code Execution via HTTP MCP

atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP server-registry backend factory, allowing network man-in-the-middle attackers to rewrite catalog responses. Attackers can inject arbitrary command and argument values that are spawned as local subprocesses by...

CVE-2026-91988 atomic-agents-stack before 1.1.0 Remote Code Execution via HTTP MCP

atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP server-registry backend factory, allowing network man-in-the-middle attackers to rewrite catalog responses. Attackers can inject arbitrary command and argument values that are spawned as local subprocesses by...

EUVD-2026-78659

atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP server-registry backend factory, allowing network man-in-the-middle attackers to rewrite catalog responses. Attackers can inject arbitrary command and argument values that are spawned as local subprocesses by...